From 34711e9cafa75a8234f3fbcb2ba27b9e7ba26c0c Mon Sep 17 00:00:00 2001 From: Alexandre Ratchov Date: Wed, 21 Mar 2018 07:02:03 +0000 Subject: Fix the way we detect xrun on the recording end, which may prevent the ring read pointer from wrapping, in turn allowing the process to read past the ring boundaries. ok deraadt@ --- sys/dev/audio.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'sys/dev/audio.c') diff --git a/sys/dev/audio.c b/sys/dev/audio.c index ab0a1dca01c..9765b1d11a9 100644 --- a/sys/dev/audio.c +++ b/sys/dev/audio.c @@ -1,4 +1,4 @@ -/* $OpenBSD: audio.c,v 1.167 2018/01/10 09:03:26 ratchov Exp $ */ +/* $OpenBSD: audio.c,v 1.168 2018/03/21 07:02:02 ratchov Exp $ */ /* * Copyright (c) 2015 Alexandre Ratchov * @@ -462,7 +462,7 @@ audio_rintr(void *addr) sc->rec.pos += sc->rec.blksz; audio_buf_wcommit(&sc->rec, sc->rec.blksz); - if (sc->rec.used == sc->rec.len) { + if (sc->rec.used > sc->rec.len - sc->rec.blksz) { DPRINTFN(1, "%s: rec overrun\n", DEVNAME(sc)); sc->rec.xrun += sc->rec.blksz; audio_buf_rdiscard(&sc->rec, sc->rec.blksz); -- cgit v1.2.3